AI governance glossary
AI risk
What is AI risk?
AI risk is the combination of how likely an AI system is to cause harm and how severe that harm would be, to people, organisations or society. The EU AI Act defines risk this way, and the NIST AI RMF uses the same probability-and-consequence composite.
Why it matters
- Risk level decides the legal regime: the EU AI Act prohibits some practices, regulates high-risk systems in detail and leaves most other systems to transparency duties.
- A documented, repeatable risk assessment is central to ISO/IEC 42001 and to the Map and Measure functions of the NIST AI RMF.
- Risk changes after deployment, so assessments need re-running when the data, the model or the use changes.
In detail
The EU AI Act defines risk as the combination of the probability of an occurrence of harm and the severity of that harm (Article 3(2)); the NIST AI Risk Management Framework describes it as a composite of an event's probability and the magnitude of its consequences. AI risks include harm to health, safety and fundamental rights, discrimination, security failures and misinformation, and they change as a system is retrained, repurposed or connected to new tools.
Source: EU AI Act (Regulation (EU) 2024/1689), Article 3(2). A plain-language explanation for orientation, not the legal text; follow the source for the binding wording.
AI risk register →AI risk assessment control →AI risk and incidents →
Laws and policies on record that use it
- Colorado AI ActColorado (United States) · Repealed
- Queensland AI governance policyQueensland (Australia) · In force
- NIST AI RMFUnited States · Voluntary standard
- Singapore Model AI Governance FrameworkSingapore · Voluntary standard
Duties that mention it
- Establish internal governance structures and measures for AISingapore Model AI Governance Framework · Singapore
- Deployers must implement a risk management policy and programmeColorado AI Act · Colorado (United States)
- Establish AI governance policies, roles and accountability (Govern)NIST AI RMF · United States
- Prioritise, respond to and monitor AI risks (Manage)NIST AI RMF · United States
Related concepts
- High-risk AI systemIn the EU AI Act, an AI system that is a safety component of (or is itself) a product covered by the EU produc...
- AI impact assessmentAn AI impact assessment is a structured evaluation, before deployment and whenever things change, of how an AI...
- NIST AI Risk Management Framework (AI RMF)The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary US framework, published in January 2023, for...
- Red teaming (AI)AI red teaming is structured adversarial testing in which testers try to make an AI system fail, by producing...
All glossary terms · Think a definition is off? Tell us; corrections are logged on the corrections page.
Frequently asked questions
What is AI risk?
AI risk is the combination of how likely an AI system is to cause harm and how severe that harm would be, to people, organisations or society. The EU AI Act defines risk this way, and the NIST AI RMF uses the same probability-and-consequence composite.
Where does the term AI risk come from?
This explanation follows EU AI Act (Regulation (EU) 2024/1689), Article 3(2). It is a plain-language paraphrase for orientation; the source has the binding wording.
Which laws and policies use the term AI risk?
Among the records on this site: Colorado AI Act (Colorado); Queensland AI governance policy (Queensland); NIST AI RMF (US) and Singapore Model AI Governance Framework (Singapore).